db46752e87a53bd7515b52dfc32bfc3ed70ed28de478f32f6609f97456a8128f

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15566da3d983bc1b70058b9aa44d8c70_JaffaCakes118.pdf
Size

87KB
MD5

15566da3d983bc1b70058b9aa44d8c70
SHA1

c8421e9ae84209c5e277d8342e64d04a6fcbc594
SHA256

db46752e87a53bd7515b52dfc32bfc3ed70ed28de478f32f6609f97456a8128f
SHA512

0bf555f4a4287bcf69ab20cf1fbb15b76ef07d9f6eefbd19c98f085989c994365fc91ecf5b0a7fa921bb7a7c5fdecbf26f9218f4485ce2899e77318215ab4296
SSDEEP

1536:ScbPq2koEQBxShAQ/BNVxHsKuMseCr4NKkC26r26VuWUpO7oIuBW8d8V90FCik+O:VbNzBCTDVxHRse6a6Z7olg8FCik1YHG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1348	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\15566da3d983bc1b70058b9aa44d8c70_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ba1f1ea9acad2a8da2fd0bbd0a2e5e1a

SHA1
f12eacc307b63427d495c0037e06ae505a017eb7

SHA256
7cd8a02ba75edeef63ee135cbc8ae6c5737c637f32ddcfcbb74219b7137b75ce

SHA512
5f47732fd71b618f9a83629242ce6202a485d68a2c9c06809fab9c2ecf69683d5c05011e23c6651cd4030e6a927553051fb2c26e3ad201a47b446d2af6881939

Download Submit